应用安全支撑平台体系结构与实现机制研究  

Research on architecture and implementation of application security supportive platform

作　　者：龚雷[1,2,3] 赵勇[3] 

机构地区：[1]解放军信息工程大学电子技术学院,河南郑州450004 [2]信息网络安全公安部重点实验室,上海201204 [3]北京工业大学计算机学院,北京100124

出　　处：《计算机工程与设计》2011年第7期2217-2220,共4页Computer Engineering and Design

基　　金：国家863高技术研究发展计划基金项目(2009AA01Z437);国家973重点基础研究发展计划基金项目(2007CB311100);信息网络安全公安部重点实验室开放基金项目

摘　　要：针对等级保护工作中应用系统面临的典型安全问题,设计并实现了应用安全支撑平台。该平台以可信计算为基础,最小权限为原则,利用应用环境中资源与进程的映射,构建可信域与非可信域,限制了应用安全漏洞能够影响的范围,实现了应用间信息流的安全隔离。利用应用安全封装机制,在系统内核层对来自上层应用的信息流加以分析和判决,确保了安全机制的通用性与不可旁路性。The typical security problems of application systems in classified protection work is analyzed, and then the application security supportive platform is designed. The platform is based on trusted computing technology and least privilege principle, divides resources in application environment into several parts mapping to specific processes, and then sets up trusted and untrusted domains, so that the influence of application system vulnerabilities could be confined and the information flow from different application systems could be iso- lated. The platform also utilizes the technology called application security encapsulation in system kernel to analyze and judge the information flow from application layer, so that the generalization security mechanism can be guaranteed and cannot be bypassed.

关 键 词：信息安全等级保护 安全体系结构 应用安全 可信域 应用安全封装 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]